CHFI Storage Forensics and File System Analysis Practice Question
Which THREE of the following are challenges specific to forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives (HDDs)? (Select three.)
⚠ Common exam trap
EC-Council often tests the misconception that SSDs have higher read latency due to their electronic nature, but in reality, SSDs have much lower latency than HDDs because they lack moving parts; the trap is to confuse latency with the unpredictability of wear leveling or garbage collection delays.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The TRIM command can permanently erase deleted data
Option A is correct because the ATA TRIM command (and SCSI UNMAP) tells the SSD controller that blocks are no longer in use, allowing the drive to erase them via garbage collection, which can permanently destroy deleted data before an examiner images the drive. Option C is correct because wear leveling and garbage collection relocate logical blocks to different physical NAND pages transparently, so logical-to-physical mapping changes constantly and traditional file-carving based on physical offsets becomes unreliable. Option D is correct because many SSDs implement hardware-based full-disk encryption (e.g., OPAL/TCG or proprietary SED encryption) tied to the controller, and without the credential or a powered-on unlocked state the data is inaccessible even after chip-off. Option B is wrong because SSDs generally have lower, not higher, read latency than HDDs since there is no seek or rotational delay. Option E is wrong because bad-block remapping exists on both HDDs and SSDs and is not a challenge specific to SSD forensics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The TRIM command can permanently erase deleted data
Why this is correct
The TRIM command tells an SSD to wipe the physical blocks that hold deleted file data by sending an ATA command that removes the mapping and allows garbage collection to zero the cells. Once TRIM is issued, the original data is permanently erased and cannot be recovered by software or even sophisticated laboratory techniques. This is a flash-specific obstacle because HDDs do not have TRIM; on a hard disk, deleted files remain in place until overwritten.
- ✗
SSDs have higher latency for read operations
Why it's wrong here
SSDs are built on NAND flash with no rotating platters or moving read/write heads, so their random read latency is measured in microseconds rather than the milliseconds typical of HDDs. Therefore, claiming that SSDs have higher read latency is false; they are consistently faster for both sequential and random reads. The real forensic complication with SSDs is not slower access but the autonomous background operations like garbage collection and TRIM that can modify data during acquisition.
- ✓
Wear leveling algorithms move data unpredictably
Why this is correct
Wear leveling is a controller-level algorithm that rotates write operations across all NAND blocks to prevent any single block from wearing out prematurely, so the logical block address (LBA) a file occupies is constantly remapped to different physical pages. Because the physical location of data changes dynamically and garbage collection may relocate or erase blocks in the background, a forensic image taken at the LBA level does not represent the actual physical state of the flash, making sector-level recovery and analysis of deleted data very difficult. This unpredictability is a unique SSD characteristic that directly hinders evidence reconstruction.
- ✓
Built-in hardware encryption may prevent data access
Why this is correct
Self-encrypting drives (SEDs) encrypt all data with a media encryption key (MEK) that is internally generated and wrapped by an authentication key stored in the drive's firmware; when the drive is locked, the MEK is not released and reads return only encrypted ciphertext. Without the correct passphrase or external key management credential, even a forensic clone produces undecipherable random-looking data, and brute-force attacks are infeasible on modern AES implementations. This is a distinct and severe access problem that does not affect non-encrypted conventional HDDs or SSDs.
- ✗
Bad block remapping is more frequent on SSDs
Why it's wrong here
Bad block remapping is a standard internal mechanism found in both HDDs and SSDs: defective sectors or NAND blocks are automatically reassigned to spare areas by the device firmware. While SSDs do generate more bad blocks as flash memory wears and have a more sophisticated mapping due to wear leveling, the mere frequency of remapping events is not inherently higher across all SSD products, and this behavior is not unique to SSDs. Therefore it cannot be considered a forensic challenge specific to solid-state drives, and in practice the bigger issues are TRIM, encryption, and garbage collection.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.